Cybersecurity researchers have uncovered a sophisticated attack method that exploits external multifactor authentication (MFA) providers to steal users’ passwords during legitimate login attempts. Dubbed TrustSink by Varonis Threat Labs, this technique can compromise any organization using external MFA providers with Microsoft Entra.
The attack works as follows: an attacker with highly privileged access to an Entra account registers a rogue External Authentication Method (EAM) provider, which is then added to the list of trusted authentication services. When a user attempts to log in, they are redirected to the malicious provider for the second factor of MFA. The fake provider displays a convincing Microsoft password prompt, tricking the user into entering their password again. Meanwhile, the actual credentials are sent to the attacker’s server.
To test this attack, Varonis researchers demonstrated its effectiveness by creating a rogue external MFA provider that mimicked Microsoft’s legitimate login page. When a victim entered their real password on the fake page, the attackers’ server received the credential in plaintext along with timestamps and source IP addresses. What’s more, even after the user reset their password, the rogue provider remained in the authentication flow, capturing the new credentials at the next sign-in attempt.
This attack is particularly insidious because it doesn’t require initial access to a target organization’s network or systems; rather, an attacker must already control a highly privileged Entra account. To exploit this vulnerability, attackers would need to obtain a Global Administrator or Authentication Policy Administrator account, which could potentially be achieved through phishing or other social engineering tactics.
The researchers also noted that TrustSink builds upon previous work by security researcher Dirk-Jan Mollema, who demonstrated how a rogue registered external MFA provider can satisfy an MFA requirement without actually performing the expected authentication check. TrustSink takes this concept to the next level by using it for credential theft.
For organizations relying on external MFA providers with Microsoft Entra, this attack serves as a stark reminder of the importance of internal security controls and monitoring. While external MFA providers can offer an added layer of protection against unauthorized access, they are only as secure as their weakest link – namely, the organizations that manage them. To mitigate this risk, administrators should ensure that all users with high-level administrative privileges are thoroughly vetted and monitored for suspicious activity.
In practical terms, organizations using external MFA providers with Entra should take the following steps to protect themselves against TrustSink:
* Regularly review and update authentication policies and permissions
* Monitor accounts with highly privileged access for signs of unauthorized activity
* Use robust internal security controls to detect and prevent phishing attacks
* Ensure that all users are educated on the risks associated with MFA providers and how to identify suspicious login prompts
By staying vigilant and proactive, organizations can minimize their exposure to this type of sophisticated attack and protect their users’ credentials from falling into the wrong hands.
Source: Bleeping Computer — 2026-09-22